linux/fs/ext3
Vasily Averin a6c15c2b0f ext3/ext4: orphan list corruption due bad inode
After ext3 orphan list check has been added into ext3_destroy_inode()
(please see my previous patch) the following situation has been detected:

 EXT3-fs warning (device sda6): ext3_unlink: Deleting nonexistent file (37901290), 0
 Inode 00000101a15b7840: orphan list check failed!
 00000773 6f665f00 74616d72 00000573 65725f00 06737270 66000000 616d726f
...
 Call Trace: [<ffffffff80211ea9>] ext3_destroy_inode+0x79/0x90
  [<ffffffff801a2b16>] sys_unlink+0x126/0x1a0
  [<ffffffff80111479>] error_exit+0x0/0x81
  [<ffffffff80110aba>] system_call+0x7e/0x83

First messages said that unlinked inode has i_nlink=0, then ext3_unlink()
adds this inode into orphan list.

Second message means that this inode has not been removed from orphan list.
 Inode dump has showed that i_fop = &bad_file_ops and it can be set in
make_bad_inode() only.  Then I've found that ext3_read_inode() can call
make_bad_inode() without any error/warning messages, for example in the
following case:

...
        if (inode->i_nlink == 0) {
                if (inode->i_mode == 0 ||
                    !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ORPHAN_FS)) {
                        /* this inode is deleted */
                        brelse (bh);
                        goto bad_inode;
...

Bad inode can live some time, ext3_unlink can add it to orphan list, but
ext3_delete_inode() do not deleted this inode from orphan list.  As result
we can have orphan list corruption detected in ext3_destroy_inode().

However it is not clear for me how to fix this issue correctly.

As far as i see is_bad_inode() is called after iget() in all places
excluding ext3_lookup() and ext3_get_parent().  I believe it makes sense to
add bad inode check to these functions too and call iput if bad inode
detected.

Signed-off-by:	Vasily Averin <vvs@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 09:05:46 -07:00
..
acl.c [PATCH] fs: Removing useless casts 2006-09-27 08:26:10 -07:00
acl.h [PATCH] Remove leftover ext3 acl declarations 2006-07-10 13:24:26 -07:00
balloc.c [PATCH] ext[234]: update documentation 2007-02-20 17:10:14 -08:00
bitmap.c [PATCH] ext3 and jbd cleanup: remove whitespace 2006-09-27 08:26:09 -07:00
dir.c header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
ext3_jbd.c [PATCH] ext3: uninline large functions 2006-12-07 08:39:35 -08:00
file.c sendfile: remove .sendfile from filesystems that use generic_file_sendfile() 2007-07-10 08:04:13 +02:00
fsync.c [PATCH] ext3 and jbd cleanup: remove whitespace 2006-09-27 08:26:09 -07:00
hash.c [PATCH] remove many unneeded #includes of sched.h 2007-02-14 08:09:54 -08:00
ialloc.c [PATCH] inode-diet: Eliminate i_blksize from the inode structure 2006-09-27 08:26:18 -07:00
inode.c ext3: lost brelse in ext3_read_inode() 2007-06-24 08:59:12 -07:00
ioctl.c ext3: copy i_flags to inode flags on write 2007-05-08 11:15:12 -07:00
Makefile [PATCH] ext3: uninline large functions 2006-12-07 08:39:35 -08:00
namei.c ext3/ext4: orphan list corruption due bad inode 2007-07-16 09:05:46 -07:00
namei.h [PATCH] ext3: sparse fixes 2005-10-30 17:37:25 -08:00
resize.c header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
super.c ext3/ext4: orphan list check on destroy_inode 2007-07-16 09:05:46 -07:00
symlink.c [PATCH] mark struct inode_operations const 1 2007-02-12 09:48:46 -08:00
xattr_security.c header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
xattr_trusted.c header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
xattr_user.c header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
xattr.c [PATCH] "ext[34]: EA block reference count racing fix" performance fix 2007-03-23 11:01:22 -07:00
xattr.h Remove obsolete #include <linux/config.h> 2006-06-30 19:25:36 +02:00